Buggy code:
class SMIMEAssertion { private static final Logger log = LoggingManager . getLoggerForShortName ( SMIMEAssertionTestElement . class . getName ( ) ) ; SMIMEAssertion ( ) { } public static AssertionResult getResult ( SMIMEAssertionTestElement testElement , SampleResult response , String name ) { } private static AssertionResult verifySignature ( SMIMEAssertionTestElement testElement , SMIMESignedParser s , String name ) throws CMSException { AssertionResult res = new AssertionResult ( name ) ; try { CertStore certs = s . getCertificatesAndCRLs ( "Collection" , "BC" ) ; SignerInformationStore signers = s . getSignerInfos ( ) ; Iterator < ? > signerIt = signers . getSigners ( ) . iterator ( ) ; if ( signerIt . hasNext ( ) ) { SignerInformation signer = ( ( SignerInformation ) ( signerIt . next ( ) ) ) ; Iterator < ? > certIt = certs . getCertificates ( signer . getSID ( ) ) . iterator ( ) ; if ( certIt . hasNext ( ) ) { X509Certificate cert = ( ( X509Certificate ) ( certIt . next ( ) ) ) ; if ( testElement . isVerifySignature ( ) ) { if ( ! ( signer . verify ( cert . getPublicKey ( ) , "BC" ) ) ) { res . setFailure ( true ) ; res . setFailureMessage ( "Signature<seq2seq4repair_space>is<seq2seq4repair_space>invalid" ) ; } } if ( testElement . isSignerCheckConstraints ( ) ) { <START_BUG> StringBuffer failureMessage = new StringBuffer ( ) ; <END_BUG> String serial = testElement . getSignerSerial ( ) ; if ( ( serial . trim ( ) . length ( ) ) > 0 ) { BigInteger serialNbr = SMIMEAssertion . readSerialNumber ( serial ) ; if ( ! ( serialNbr . equals ( cert . getSerialNumber ( ) ) ) ) { res . setFailure ( true ) ; failureMessage . append ( "Serial<seq2seq4repair_space>number<seq2seq4repair_space>" ) . append ( serialNbr ) . append ( "<seq2seq4repair_space>does<seq2seq4repair_space>not<seq2seq4repair_space>match<seq2seq4repair_space>serial<seq2seq4repair_space>from<seq2seq4repair_space>signer<seq2seq4repair_space>certificate:<seq2seq4repair_space>" ) . append ( cert . getSerialNumber ( ) ) . append ( "\n" ) ; } } String email = testElement . getSignerEmail ( ) ; if ( ( email . trim ( ) . length ( ) ) > 0 ) { List < String > emailfromCert = SMIMEAssertion . getEmailFromCert ( cert ) ; if ( ! ( emailfromCert . contains ( email ) ) ) { res . setFailure ( true ) ; failureMessage . append ( "Email<seq2seq4repair_space>address<seq2seq4repair_space>\"" ) . append ( email ) . append ( "\"<seq2seq4repair_space>not<seq2seq4repair_space>present<seq2seq4repair_space>in<seq2seq4repair_space>signer<seq2seq4repair_space>certificate\n" ) ; } } String subject = testElement . getSignerDn ( ) ; if ( ( subject . length ( ) ) > 0 ) { final X500Principal certPrincipal = cert . getSubjectX500Principal ( ) ; SMIMEAssertion . log . debug ( certPrincipal . getName ( X500Principal . CANONICAL ) ) ; X500Principal principal = new X500Principal ( subject ) ; SMIMEAssertion . log . debug ( principal . getName ( X500Principal . CANONICAL ) ) ; if ( ! ( principal . equals ( certPrincipal ) ) ) { res . setFailure ( true ) ; failureMessage . append ( "Distinguished<seq2seq4repair_space>name<seq2seq4repair_space>of<seq2seq4repair_space>signer<seq2seq4repair_space>certificate<seq2seq4repair_space>does<seq2seq4repair_space>not<seq2seq4repair_space>match<seq2seq4repair_space>\"" ) . append ( subject ) . append ( "\"\n" ) ; } } String issuer = testElement . getIssuerDn ( ) ; if ( ( issuer . length ( ) ) > 0 ) { final X500Principal issuerX500Principal = cert . getIssuerX500Principal ( ) ; SMIMEAssertion . log . debug ( issuerX500Principal . getName ( X500Principal . CANONICAL ) ) ; X500Principal principal = new X500Principal ( issuer ) ; SMIMEAssertion . log . debug ( principal . getName ( X500Principal . CANONICAL ) ) ; if ( ! ( principal . equals ( issuerX500Principal ) ) ) { res . setFailure ( true ) ; failureMessage . append ( "Issuer<seq2seq4repair_space>distinguished<seq2seq4repair_space>name<seq2seq4repair_space>of<seq2seq4repair_space>signer<seq2seq4repair_space>certificate<seq2seq4repair_space>does<seq2seq4repair_space>not<seq2seq4repair_space>match<seq2seq4repair_space>\"" ) . append ( subject ) . append ( "\"\n" ) ; } } if ( ( failureMessage . length ( ) ) > 0 ) { res . setFailureMessage ( failureMessage . toString ( ) ) ; } } if ( testElement . isSignerCheckByFile ( ) ) { CertificateFactory cf = CertificateFactory . getInstance ( "X.509" ) ; X509Certificate certFromFile ; FileInputStream inStream = null ; try { inStream = new FileInputStream ( testElement . getSignerCertFile ( ) ) ; certFromFile = ( ( X509Certificate ) ( cf . generateCertificate ( inStream ) ) ) ; } finally { IOUtils . closeQuietly ( inStream ) ; } if ( ! ( certFromFile . equals ( cert ) ) ) { res . setFailure ( true ) ; res . setFailureMessage ( ( "Signer<seq2seq4repair_space>certificate<seq2seq4repair_space>does<seq2seq4repair_space>not<seq2seq4repair_space>match<seq2seq4repair_space>certificate<seq2seq4repair_space>" + ( testElement . getSignerCertFile ( ) ) ) ) ; } } } else { res . setFailure ( true ) ; res . setFailureMessage ( "No<seq2seq4repair_space>signer<seq2seq4repair_space>certificate<seq2seq4repair_space>found<seq2seq4repair_space>in<seq2seq4repair_space>signature" ) ; } } if ( signerIt . hasNext ( ) ) { SMIMEAssertion . log . warn ( "SMIME<seq2seq4repair_space>message<seq2seq4repair_space>contains<seq2seq4repair_space>multiple<seq2seq4repair_space>signers!<seq2seq4repair_space>Checking<seq2seq4repair_space>multiple<seq2seq4repair_space>signers<seq2seq4repair_space>is<seq2seq4repair_space>not<seq2seq4repair_space>supported." ) ; } } catch ( GeneralSecurityException e ) { SMIMEAssertion . log . error ( e . getMessage ( ) , e ) ; res . setError ( true ) ; res . setFailureMessage ( e . getMessage ( ) ) ; } catch ( FileNotFoundException e ) { res . setFailure ( true ) ; res . setFailureMessage ( ( "certificate<seq2seq4repair_space>file<seq2seq4repair_space>not<seq2seq4repair_space>found:<seq2seq4repair_space>" + ( e . getMessage ( ) ) ) ) ; } return res ; } private static MimeMessage getMessageFromResponse ( SampleResult response , int messageNumber ) throws MessagingException { } private static BigInteger readSerialNumber ( String serialString ) { } private static List < String > getEmailFromCert ( X509Certificate cert ) throws CertificateException { } private static void checkForBouncycastle ( ) { } }

Fix:
StringBuilder failureMessage = new StringBuilder ( ) ;